<?xml version="1.0" encoding="utf-8"?>
<Content xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="urn:blueonionsoftware-com:bloget:runtime:data">
  <text>I wanted to track every call to VirtualAllocEx() when using just the MEM_RESERVE flag for large buffers.  The reason for this can be discussed in another post, as well as some nice M$ tools which can help with this type of problem (DebugDiag and Detours).

So add a breakpoint with this info:

Location:  0x7C809A72
Condition:  (((BY (esp + 17)) &amp; 0x30) == 0x20) &amp;&amp; ((DW (esp + 12)) != 0)
When hit:  MEM_RESERVE, {dw (ESP + 12)}

0x7C809A72 is the start address for _VirtualAllocEx@20, in kernel32.dll.
The condition is such that the breakpoint only does its work if that expression = true.  I wanted to break only when the MEM_RESERVE bitflag was set, that corresponds to 17 bytes after the stack pointer.  Note these prefixes are used to dereference a pointer:
BY, read byte value at address
WO, read word value
DW, read dword value

The DWORD starting at ESP + 12, corresponds to the requested mem size parameter of this function call.

The When Hit just prints out to the output window, the message showing the requested buffer size.

Getting the start address of the desired function call, at least two ways to do that:
1)  Google it
2)  Or, break in the debugger, open the disassembly window, then keep stepping into something that will eventually call the desired function so you can learn its info.

-Chris O</text>
  <last_update>2007-10-04T00:52:31.9810806Z</last_update>
  <source_title />
  <source_link />
  <comments />
  <references />
  <attachments />
</Content>